1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
<!ENTITY VERSION "1.0">
4
5
<!ENTITY COMMANDNAME "mandos-keygen">
5
<!ENTITY TIMESTAMP "2019-07-18">
6
<!ENTITY % common SYSTEM "common.ent">
6
<!ENTITY TIMESTAMP "2008-09-12">
10
9
<refentry xmlns:xi="http://www.w3.org/2001/XInclude">
12
11
<title>Mandos Manual</title>
13
12
<!-- NWalsh’s docbook scripts use this to generate the footer: -->
14
13
<productname>Mandos</productname>
15
<productnumber>&version;</productnumber>
14
<productnumber>&VERSION;</productnumber>
16
15
<date>&TIMESTAMP;</date>
19
18
<firstname>Björn</firstname>
20
19
<surname>Påhlsson</surname>
22
<email>belorn@recompile.se</email>
21
<email>belorn@fukt.bsnet.se</email>
26
25
<firstname>Teddy</firstname>
27
26
<surname>Hogeborn</surname>
29
<email>teddy@recompile.se</email>
28
<email>teddy@fukt.bsnet.se</email>
46
34
<holder>Teddy Hogeborn</holder>
47
35
<holder>Björn Påhlsson</holder>
127
115
<replaceable>TIME</replaceable></option></arg>
131
<arg choice="plain"><option>--tls-keytype
132
<replaceable>KEYTYPE</replaceable></option></arg>
133
<arg choice="plain"><option>-T
134
<replaceable>KEYTYPE</replaceable></option></arg>
138
<arg choice="plain"><option>--force</option></arg>
139
<arg choice="plain"><option>-f</option></arg>
118
<arg><option>--force</option></arg>
143
121
<command>&COMMANDNAME;</command>
144
122
<group choice="req">
145
123
<arg choice="plain"><option>--password</option></arg>
146
124
<arg choice="plain"><option>-p</option></arg>
147
<arg choice="plain"><option>--passfile
148
<replaceable>FILE</replaceable></option></arg>
149
<arg choice="plain"><option>-F</option>
150
<replaceable>FILE</replaceable></arg>
163
137
<arg choice="plain"><option>-n
164
138
<replaceable>NAME</replaceable></option></arg>
167
<arg choice="plain"><option>--no-ssh</option></arg>
168
<arg choice="plain"><option>-S</option></arg>
172
142
<command>&COMMANDNAME;</command>
188
158
<title>DESCRIPTION</title>
190
160
<command>&COMMANDNAME;</command> is a program to generate the
191
TLS and OpenPGP keys used by
192
162
<citerefentry><refentrytitle>mandos-client</refentrytitle>
193
<manvolnum>8mandos</manvolnum></citerefentry>. The keys are
194
normally written to /etc/keys/mandos for later installation into
195
the initrd image, but this, and most other things, can be
196
changed with command line options.
163
<manvolnum>8mandos</manvolnum></citerefentry>. The key is
164
normally written to /etc/mandos for later installation into the
165
initrd image, but this, and most other things, can be changed
166
with command line options.
199
169
This program can also be used with the
200
<option>--password</option> or <option>--passfile</option>
201
options to generate a ready-made section for
202
<filename>clients.conf</filename> (see
170
<option>--password</option> option to generate a ready-made
171
section for <filename>clients.conf</filename> (see
203
172
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
204
173
<manvolnum>5</manvolnum></citerefentry>).
236
205
<replaceable>DIRECTORY</replaceable></option></term>
239
Target directory for key files. Default is <filename
240
class="directory">/etc/keys/mandos</filename>.
208
Target directory for key files. Default is
209
<filename>/etc/mandos</filename>.
332
<term><option>--tls-keytype
333
<replaceable>KEYTYPE</replaceable></option></term>
335
<replaceable>KEYTYPE</replaceable></option></term>
338
TLS key type. Default is <quote>ed25519</quote>
344
303
<term><option>--force</option></term>
345
304
<term><option>-f</option></term>
357
316
Prompt for a password and encrypt it with the key already
358
present in either <filename>/etc/keys/mandos</filename> or
359
the directory specified with the <option>--dir</option>
317
present in either <filename>/etc/mandos</filename> or the
318
directory specified with the <option>--dir</option>
360
319
option. Outputs, on standard output, a section suitable
361
320
for inclusion in <citerefentry><refentrytitle
362
321
>mandos-clients.conf</refentrytitle><manvolnum
363
322
>8</manvolnum></citerefentry>. The host name or the name
364
323
specified with the <option>--name</option> option is used
365
324
for the section header. All other options are ignored,
366
and no key is created. Note: white space is stripped from
367
the beginning and from the end of the password; See <xref
373
<term><option>--passfile
374
<replaceable>FILE</replaceable></option></term>
376
<replaceable>FILE</replaceable></option></term>
379
The same as <option>--password</option>, but read from
380
<replaceable>FILE</replaceable>, not the terminal, and
381
white space is not stripped from the password in any way.
386
<term><option>--no-ssh</option></term>
387
<term><option>-S</option></term>
390
When <option>--password</option> or
391
<option>--passfile</option> is given, this option will
392
prevent <command>&COMMANDNAME;</command> from calling
393
<command>ssh-keyscan</command> to get an SSH fingerprint
394
for this host and, if successful, output suitable config
395
options to use this fingerprint as a
396
<option>checker</option> option in the output. This is
397
otherwise the default behavior.
325
and no key is created.
405
333
<title>OVERVIEW</title>
406
334
<xi:include href="overview.xml"/>
408
This program is a small utility to generate new TLS and OpenPGP
409
keys for new Mandos clients, and to generate sections for
410
inclusion in <filename>clients.conf</filename> on the server.
336
This program is a small utility to generate new OpenPGP keys for
337
new Mandos clients, and to generate sections for inclusion in
338
<filename>clients.conf</filename> on the server.
466
<term><filename>/etc/keys/mandos/tls-privkey.pem</filename></term>
469
Private key file which will be created or overwritten.
474
<term><filename>/etc/keys/mandos/tls-pubkey.pem</filename></term>
477
Public key file which will be created or overwritten.
482
<term><filename class="directory">/tmp</filename></term>
394
<term><filename>/tmp</filename></term>
485
397
Temporary files will be written here if
496
The <option>--password</option>/<option>-p</option> option
497
strips white space from the start and from the end of the
498
password before using it. If this is a problem, use the
499
<option>--passfile</option> option instead, which does not do
502
<xi:include href="bugs.xml"/>
405
<!-- <refsect1 id="bugs"> -->
406
<!-- <title>BUGS</title> -->
505
411
<refsect1 id="example">
506
412
<title>EXAMPLE</title>
526
432
</informalexample>
527
433
<informalexample>
529
Prompt for a password, encrypt it with the keys in <filename
530
class="directory">/etc/keys/mandos</filename> and output a
531
section suitable for <filename>clients.conf</filename>.
435
Prompt for a password, encrypt it with the key in
436
<filename>/etc/mandos</filename> and output a section suitable
437
for <filename>clients.conf</filename>.
534
440
<userinput>&COMMANDNAME; --password</userinput>
536
442
</informalexample>
537
443
<informalexample>
539
Prompt for a password, encrypt it with the keys in the
445
Prompt for a password, encrypt it with the key in the
540
446
<filename>client-key</filename> directory and output a section
541
447
suitable for <filename>clients.conf</filename>.
567
473
<refsect1 id="see_also">
568
474
<title>SEE ALSO</title>
570
<citerefentry><refentrytitle>intro</refentrytitle>
571
<manvolnum>8mandos</manvolnum></citerefentry>,
572
476
<citerefentry><refentrytitle>gpg</refentrytitle>
573
477
<manvolnum>1</manvolnum></citerefentry>,
574
478
<citerefentry><refentrytitle>mandos-clients.conf</refentrytitle>
576
480
<citerefentry><refentrytitle>mandos</refentrytitle>
577
481
<manvolnum>8</manvolnum></citerefentry>,
578
482
<citerefentry><refentrytitle>mandos-client</refentrytitle>
579
<manvolnum>8mandos</manvolnum></citerefentry>,
580
<citerefentry><refentrytitle>ssh-keyscan</refentrytitle>
581
<manvolnum>1</manvolnum></citerefentry>
483
<manvolnum>8mandos</manvolnum></citerefentry>
added
removed
mandos-keygen.xml
